ANNEX IISupplementary provisions
ANNEX II PHYSICAL SECURITY I. INTRODUCTION 1. This Annex sets out provisions for implementing Article 8. It lays down minimum requirements for the physical protection of premises, buildings, offices, rooms and other areas where EUCI is handled and stored, including areas housing CIS. 2. Physical security measures shall be designed to prevent unauthorised access to EUCI by: (a) ensuring that EUCI is handled and stored in an appropriate manner; (b) allowing for segregation of personnel in terms of access to EUCI on the basis of their need-to-know and, where appropriate, their security clearance; (c) deterring, impeding and detecting unauthorised actions; and (d) denying or delaying surreptitious or forced entry by intruders. II. PHYSICAL SECURITY REQUIREMENTS AND MEASURES 3. Physical security measures shall be selected on the basis of a threat assessment made by the competent authorities. The GSC and Member States shall each apply a risk management process for protecting EUCI on their premises to ensure that a commensurate level of physical protection is afforded against the assessed risk. The risk management process shall take account of all relevant factors, in particular: (a) the classification level of EUCI; (b) the form and volume of EUCI, bearing in mind that large quantities or a compilation of EUCI may require more stringent protective measures to be applied; (c) the surrounding environment and structure of the buildings or areas housing EUCI; and (d) the assessed threat from intelligence services which target the Union or Member States and from sabotage, terrorist, subversive or other criminal activities. 4. The competent security authority, applying the concept of defence in depth, shall determine the appropriate combination of physical security measures to be implemented. These can include one or more of the following: (a) a perimeter barrier: a physical barrier which defends the boundary of an area requiring protection; (b) intrusion detection systems (IDS): an IDS may be used to enhance the level of security offered by a perimeter barrier, or in rooms and buildings in place of, or to assist, security staff; (c) access control: access control may be exercised over a site, a building or buildings on a site or to areas or rooms within a building. Control may be exercised by electronic or electro-mechanical means, by security personnel and/or a receptionist, or by any other physical means; (d) security personnel: trained, supervised and, where necessary, appropriately security-cleared security personnel may be employed, inter alia, in order to deter individuals planning covert intrusion; (e) closed circuit television (CCTV): CCTV may be used by security personnel in order to verify incidents and IDS alarms on large sites or at perimeters; (f) security lighting: security lighting may be used to deter a potential intruder, as well as to provide the illumination necessary for effective surveillance directly by security personnel or indirectly through a CCTV system; and (g) any other appropriate physical measures designed to deter or detect unauthorised access or prevent loss of or damage to EUCI. 5. The competent authority can be authorised to conduct entry and exit searches to act as a deterrent to the unauthorised introduction of material or the unauthorised removal of EUCI from premises or buildings. 6. When EUCI is at risk from overlooking, even accidentally, appropriate measures shall be taken to counter this risk. 7. For new facilities, physical security requirements and their functional specifications shall be defined as part of the planning and design of the facilities. For existing facilities, physical security requirements shall be implemented to the maximum extent possible. III. EQUIPMENT FOR THE PHYSICAL PROTECTION OF EUCI 8. When acquiring equipment (such as security containers, shredding machines, door locks, electronic access control systems, IDS, alarm systems) for the physical protection of EUCI, the competent security authority shall ensure that the equipment meets approved technical standards and minimum requirements. 9. The technical specifications of equipment to be used for the physical protection of EUCI shall be set out in security guidelines to be approved by the Security Committee. 10. Security systems shall be inspected at regular intervals and equipment shall be maintained regularly. Maintenance work shall take account of the outcome of inspections to ensure that equipment continues to operate at optimum performance. 11. The effectiveness of individual security measures and of the overall security system shall be re-evaluated during each inspection. IV. PHYSICALLY PROTECTED AREAS 12. Two types of physically protected areas, or the national equivalents thereof, shall be established for the physical protection of EUCI: (a) Administrative Areas; and (b) Secured Areas (including technically Secured Areas). In this Decision, all references to Administrative Areas and Secured Areas, including technically Secured Areas, shall be understood as also referring to the national equivalents thereof. 13. The competent security authority shall establish that an area meets the requirements to be designated as an Administrative Area, a Secured Area or a technically Secured Area. 14. For Administrative Areas: (a) a visibly defined perimeter shall be established which allows individuals and, where possible, vehicles to be checked; (b) unescorted access shall be granted only to individuals who are duly authorised by the competent authority; and (c) all other individuals shall be escorted at all times or be subject to equivalent controls. 15. For Secured Areas: (a) a visibly defined and protected perimeter shall be established through which all entry and exit are controlled by means of a pass or personal recognition system; (b) unescorted access shall be granted only to individuals who are security-cleared and specifically authorised to enter the area on the basis of their need-to-know; and (c) all other individuals shall be escorted at all times or be subject to equivalent controls. 16. Where entry into a Secured Area constitutes, for all practical purposes, direct access to the classified information contained in it, the following additional requirements shall apply: (a) the level of highest security classification of the information normally held in the area shall be clearly indicated; (b) all visitors shall require specific authorisation to enter the area, shall be escorted at all times and shall be appropriately security cleared unless steps are taken to ensure that no access to EUCI is possible. 17. Secured Areas protected against eavesdropping shall be designated technically Secured Areas. The following additional requirements shall apply: (a) such areas shall be IDS equipped, be locked when not occupied and be guarded when occupied. Any keys shall be controlled in accordance with Section VI; (b) all persons and material entering such areas shall be controlled; (c) such areas shall be regularly physically and/or technically inspected as required by the competent security authority. Such inspections shall also be conducted following any unauthorised entry or suspicion of such entry; and (d) such areas shall be free of unauthorised communication lines, unauthorised telephones or other unauthorised communication devices and electrical or electronic equipment. 18. Notwithstanding point (d) of paragraph 17, before being used in areas where meetings are held or work is being performed involving information classified SECRET UE/EU SECRET and above, and where the threat to EUCI is assessed as high, any communications devices and electrical or electronic equipment shall first be examined by the competent security authority to ensure that no intelligible information can be inadvertently or illicitly transmitted by such equipment beyond the perimeter of the Secured Area. 19. Secured Areas which are not occupied by duty personnel on a 24-hour basis shall, where appropriate, be inspected at the end of normal working hours and at random intervals outside normal working hours, unless an IDS is in place. 20. Secured Areas and technically Secured Areas may be set up temporarily within an Administrative Area for a classified meeting or any other similar purpose. 21. Security operating procedures shall be drawn up for each Secured Area stipulating: (a) the level of EUCI which may be handled and stored in the area; (b) the surveillance and protective measures to be maintained; (c) the individuals authorised to have unescorted access to the area by virtue of their need-to-know and security clearance; (d) where appropriate, the procedures for escorts or for protecting EUCI when authorising any other individuals to access the area; and (e) any other relevant measures and procedures. 22. Strong rooms shall be constructed within Secured Areas. The walls, floors, ceilings, windows and lockable doors shall be approved by the competent security authority and afford protection equivalent to a security container approved for the storage of EUCI of the same classification level. V. PHYSICAL PROTECTIVE MEASURES FOR HANDLING AND STORING EUCI 23. EUCI which is classified RESTREINT UE/EU RESTRICTED may be handled: (a) in a Secured Area; (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or (c) outside a Secured Area or an Administrative Area provided the holder carries the EUCI in accordance with paragraphs 28 to 41 of Annex III and has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority to ensure that EUCI is protected from access by unauthorised persons. 24. EUCI which is classified RESTREINT UE/EU RESTRICTED shall be stored in suitable locked office furniture in an Administrative Area or a Secured Area. It may temporarily be stored outside a Secured Area or an Administrative Area provided the holder has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority. 25. EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL or SECRET UE/EU SECRET may be handled: (a) in a Secured Area; (b) in an Administrative Area provided the EUCI is protected from access by unauthorised individuals; or (c) outside a Secured Area or an Administrative Area provided the holder: (i) carries the EUCI in accordance with paragraphs 28 to 41 of Annex III; (ii) has undertaken to comply with compensatory measures laid down in security instructions issued by the competent security authority to ensure that EUCI is protected from access by unauthorised persons; (iii) keeps the EUCI at all times under his personal control; and (iv) in the case of documents in paper form, has notified the relevant registry of the fact. 26. EUCI which is classified CONFIDENTIEL UE/EU CONFIDENTIAL and SECRET UE/EU SECRET shall be stored in a Secured Area either in a security container or in a strong room. 27. EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall be handled in a Secured Area. 28. EUCI which is classified TRÈS SECRET UE/EU TOP SECRET shall be stored in a Secured Area under one of the following conditions: (a) in a security container in line with paragraph 8 with at least one of the following supplementary controls: (i) continuous protection or verification by cleared security staff or duty personnel; (ii) an approved IDS in combination with response security personnel; (b) in an IDS-equipped strong room in combination with response security personnel. 29. Rules governing the carriage of EUCI outside physically protected areas are set out in Annex III. VI. CONTROL OF KEYS AND COMBINATIONS USED FOR PROTECTING EUCI 30. The competent security authority shall define procedures for managing keys and combination settings for offices, rooms, strong rooms and security containers. Such procedures shall protect against unauthorised access. 31. Combination settings shall be committed to memory by the smallest possible number of individuals needing to know them. Combination settings for security containers and strong rooms storing EUCI shall be changed: (a) on receipt of a new container; (b) whenever there is a change in personnel knowing the combination; (c) whenever a compromise has occurred or is suspected; (d) when a lock has undergone maintenance or repair; and (e) at least every 12 months.